CVE-2016-10086 json
RESTful web services in CA Service Desk Manager 12.9 and CA Service Desk Management 14.1 might allow remote authenticated users to read or…
published 2017-01-18 9 y ago modified 2026-06-17 4 mo ago also EUVD-2016-1278
- cvss
- 8.1
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.6%
- EPSS 1.6% chance of exploitation in 30 days, percentile 75%
- public exploits
- 0
- none known
Summary
RESTful web services in CA Service Desk Manager 12.9 and CA Service Desk Management 14.1 might allow remote authenticated users to read or modify task information by leveraging incorrect permissions applied to a RESTful request.
Patch / fix
Exploit prediction
1.56% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 8.1 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| NVD | 2.0 | 5.5 | AV:N/AC:L/Au:S/C:P/I:P/A:N |
Classification
- Weakness
-
- CWE-264 Permissions, Privileges, and Access Controls
References
-
ca.com
/us/services-support/ca-support/ca-support-online/product-content/recommended-reading/security-notices/ca20170
patch, vendor-advisory
-
securityfocus.com
/bid/95366
vdb-entry, third-party-advisory
-
securitytracker.com
/id/1037583
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2016-10086
- NVD CVE-2016-10086
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.